LoginSign Up
← Back to all sparks
H

Huginn

INFRA · APIS
Velocity5.0

Self-hosted system for building agents that monitor the web and automate tasks

github.com/huginn/huginn ↗

Huginn moves to Ruby 4.0.9 for a regex memory-corruption fix and adds a localized web UI.

automationself-hostedrubysecurity-patchopen-source
◆Current state
Huginn v2026.10.24 upgrades to Ruby 4.0.9, which fixes memory corruption when compiling attacker-controlled regular expressions, and the official Docker images follow. The web interface can now be set to other languages with the LOCALE variable, using a translation gem. The bundled MySQL moves to 8.4.13, and Docker latest tags now update only after release specs pass.
◆Where it's heading
Since its revival in August, Huginn has shipped security fixes first, then reliability and deployment cleanup. This release is the first to add something user-facing beyond that, a localized interface, while the runtime keeps getting pulled forward.
◆Prediction
Expect translation gems for specific languages to appear and the roughly two-week release rhythm to continue with dependency and Docker upkeep.

◆Recent moves

  1. 3d ago

    v2026.10.26

    View source ↗
  2. 5d ago

    Ruby 4.0.9 security upgrade and localized web UI

    A Ruby upgrade closes a regex memory-corruption risk that matters for an agent platform that compiles user-supplied patterns, and a LOCALE setting opens the UI to translations. Docker tag handling becomes stricter too. It continues the post-revival maintenance with a first visible feature.

    View source ↗
  3. 15d ago

    OpenStreetMap map fallback, PostgreSQL 18 compose, Heroku-24

    Huginn moves from hardening to deployment cleanup: the Docker-first README, a security policy and contributing guide, Heroku-24, and dropping dead OpenShift and Cloud Foundry targets. The OpenStreetMap fallback for location events is a small user-facing fix. The PostgreSQL 18 compose example comes with a warning not to start it on old data.

    View source ↗
  4. 25d ago

    Stricter json 3 parsing, deduplicated Agent checks, MySQL 8.4

    More runtime upkeep. The json 3 upgrade now rejects duplicate keys and comments in external inputs, and automatic Agent checks are deduplicated while one is queued or running. The bundled MySQL moves to 8.4 LTS. Like most releases in this revival, it ships stricter defaults with explicit upgrade notes.

    View source ↗
  5. 1mo ago

    JSONPath method allowlist and RFC 9535 evaluation by default

    A security advisory turns into a semantics change. Legacy JSONPath method calls are now restricted to an allowlist, and RFC 9535 evaluation becomes the default. The migration only converts expressions it can verify and flags uncertain Agents for review, the same cautious approach as earlier releases.

    View source ↗
  6. 1mo ago

    Job watchdog, per-Agent proxy routing, Ruby 4 runtime

    The focus moves from security to reliability. An opt-in process-forking job runner with a runtime watchdog, execution-lock timeouts, and outbound network timeouts target stalled background jobs, a long-standing self-hosting complaint. It also adds per-Agent proxy routing and the Ruby 4 and Ubuntu Noble upgrade.

    View source ↗